[Git][NTPsec/ntpsec][master] Use external libsodium rather than carrying a copy in the tree.
Eric S. Raymond
gitlab at mg.gitlab.com
Wed Jan 18 23:31:28 UTC 2017
Eric S. Raymond pushed to branch master at NTPsec / ntpsec
Commits:
5d4b3c61 by Eric S. Raymond at 2017-01-18T18:28:39-05:00
Use external libsodium rather than carrying a copy in the tree.
The scary scenario we thus avoid is that a CVE is issued against libsodium
but the OS update doesn't fix the problem and users have no idea they're
vulnerable. Avoiding this is worth accepting more build friction on some
older distros.
- - - - -
16 changed files:
- INSTALL
- libntp/wscript
- − libsodium/LICENSE
- − libsodium/include/sodium.h
- − libsodium/include/sodium/core.h
- − libsodium/include/sodium/export.h
- − libsodium/include/sodium/randombytes.h
- − libsodium/include/sodium/randombytes_sysrandom.h
- − libsodium/include/sodium/utils.h
- − libsodium/randombytes/randombytes.c
- − libsodium/randombytes/sysrandom/randombytes_sysrandom.c
- − libsodium/sodium/core.c
- − libsodium/wscript
- ntpd/wscript
- wafhelpers/configure.py
- wscript
Changes:
=====================================
INSTALL
=====================================
--- a/INSTALL
+++ b/INSTALL
@@ -36,6 +36,14 @@ bison::
Gentoo package: sys-devel/bison
SLES: bison . Included in pattern `basis-devel`, which includes gcc, etc.
+libsodium::
+ Required to build.
+ Debian: libsodium
+ Fedora: libsodium
+ Gentoo package: dev-libs/libsodium
+ CentOS: libsodium in the epel ("Extra Packages for Enterprise Linux") repo.
+ Ubuntu 14.04 LTS: and older: https://gist.github.com/jonathanpmartins/2510f38abee1e65c6d92
+
libcap::
Required on Linux, to support dropping root.
Fedora: libcap and libcap-devel
=====================================
libntp/wscript
=====================================
--- a/libntp/wscript
+++ b/libntp/wscript
@@ -57,7 +57,7 @@ def build(ctx):
ctx(
target = "ntp",
features = "c cstlib bld_include src_include",
- use = "sodium",
+ use = "SODIUM",
source = libntp_source + libntp_source_sharable,
includes = includes,
)
=====================================
libsodium/LICENSE deleted
=====================================
--- a/libsodium/LICENSE
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright (c) 2013-2015
- * Frank Denis <j at pureftpd dot org>
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
=====================================
libsodium/include/sodium.h deleted
=====================================
--- a/libsodium/include/sodium.h
+++ /dev/null
@@ -1,10 +0,0 @@
-
-#ifndef sodium_H
-#define sodium_H
-
-#include "sodium/core.h"
-#include "sodium/randombytes.h"
-#include "sodium/randombytes_sysrandom.h"
-#include "sodium/utils.h"
-
-#endif
=====================================
libsodium/include/sodium/core.h deleted
=====================================
--- a/libsodium/include/sodium/core.h
+++ /dev/null
@@ -1,19 +0,0 @@
-
-#ifndef sodium_core_H
-#define sodium_core_H
-
-#include "export.h"
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-SODIUM_EXPORT
-int sodium_init(void)
- __attribute__ ((warn_unused_result));
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
=====================================
libsodium/include/sodium/export.h deleted
=====================================
--- a/libsodium/include/sodium/export.h
+++ /dev/null
@@ -1,32 +0,0 @@
-
-#ifndef sodium_export_H
-#define sodium_export_H
-
-#ifndef __GNUC__
-# ifdef __attribute__
-# undef __attribute__
-# endif
-# define __attribute__(a)
-#endif
-
-#ifdef SODIUM_STATIC
-# define SODIUM_EXPORT
-#else
-# if defined(_MSC_VER)
-# ifdef SODIUM_DLL_EXPORT
-# define SODIUM_EXPORT __declspec(dllexport)
-# else
-# define SODIUM_EXPORT __declspec(dllimport)
-# endif
-# else
-# if defined(__SUNPRO_C)
-# define SODIUM_EXPORT __attribute__ __global
-# elif defined(_MSG_VER)
-# define SODIUM_EXPORT extern __declspec(dllexport)
-# else
-# define SODIUM_EXPORT __attribute__ ((visibility ("default")))
-# endif
-# endif
-#endif
-
-#endif
=====================================
libsodium/include/sodium/randombytes.h deleted
=====================================
--- a/libsodium/include/sodium/randombytes.h
+++ /dev/null
@@ -1,58 +0,0 @@
-
-#ifndef randombytes_H
-#define randombytes_H
-
-#include <sys/types.h>
-
-#include <stddef.h>
-#include <stdint.h>
-
-#include "export.h"
-
-#ifdef __cplusplus
-# if __GNUC__
-# pragma GCC diagnostic ignored "-Wlong-long"
-# endif
-extern "C" {
-#endif
-
-typedef struct randombytes_implementation {
- const char *(*implementation_name)(void); /* required */
- uint32_t (*random)(void); /* required */
- void (*stir)(void); /* optional */
- uint32_t (*uniform)(const uint32_t upper_bound); /* optional, a default implementation will be used if NULL */
- void (*buf)(void * const buf, const size_t size); /* required */
- int (*close)(void); /* optional */
-} randombytes_implementation;
-
-SODIUM_EXPORT
-void randombytes_buf(void * const buf, const size_t size);
-
-SODIUM_EXPORT
-uint32_t randombytes_random(void);
-
-SODIUM_EXPORT
-uint32_t randombytes_uniform(const uint32_t upper_bound);
-
-SODIUM_EXPORT
-void randombytes_stir(void);
-
-SODIUM_EXPORT
-int randombytes_close(void);
-
-SODIUM_EXPORT
-int randombytes_set_implementation(randombytes_implementation *impl);
-
-SODIUM_EXPORT
-const char *randombytes_implementation_name(void);
-
-/* -- NaCl compatibility interface -- */
-
-SODIUM_EXPORT
-void randombytes(unsigned char * const buf, const unsigned long long buf_len);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
=====================================
libsodium/include/sodium/randombytes_sysrandom.h deleted
=====================================
--- a/libsodium/include/sodium/randombytes_sysrandom.h
+++ /dev/null
@@ -1,45 +0,0 @@
-
-#ifndef randombytes_sysrandom_H
-#define randombytes_sysrandom_H
-
-/*
- * THREAD SAFETY: randombytes_sysrandom() functions are thread-safe,
- * provided that you called sodium_init() once before using any
- * other libsodium function.
- */
-
-#include <stddef.h>
-#include <stdint.h>
-
-#include "export.h"
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-SODIUM_EXPORT
-extern struct randombytes_implementation randombytes_sysrandom_implementation;
-
-SODIUM_EXPORT
-const char *randombytes_sysrandom_implementation_name(void);
-
-SODIUM_EXPORT
-uint32_t randombytes_sysrandom(void);
-
-SODIUM_EXPORT
-void randombytes_sysrandom_stir(void);
-
-SODIUM_EXPORT
-uint32_t randombytes_sysrandom_uniform(const uint32_t upper_bound);
-
-SODIUM_EXPORT
-void randombytes_sysrandom_buf(void * const buf, const size_t size);
-
-SODIUM_EXPORT
-int randombytes_sysrandom_close(void);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
=====================================
libsodium/include/sodium/utils.h deleted
=====================================
--- a/libsodium/include/sodium/utils.h
+++ /dev/null
@@ -1,23 +0,0 @@
-
-#ifndef sodium_utils_H
-#define sodium_utils_H
-
-#include <stddef.h>
-
-#include "export.h"
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#if defined(__cplusplus) || !defined(__STDC_VERSION__) || __STDC_VERSION__ < 199901L
-# define SODIUM_C99(X)
-#else
-# define SODIUM_C99(X) X
-#endif
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
=====================================
libsodium/randombytes/randombytes.c deleted
=====================================
--- a/libsodium/randombytes/randombytes.c
+++ /dev/null
@@ -1,88 +0,0 @@
-
-#include <sys/types.h>
-
-#include <assert.h>
-#include <limits.h>
-#include <stdint.h>
-
-#include "randombytes.h"
-#include "randombytes_sysrandom.h"
-
-static const randombytes_implementation *implementation =
- &randombytes_sysrandom_implementation;
-
-int
-randombytes_set_implementation(randombytes_implementation *impl)
-{
- implementation = impl;
-
- return 0;
-}
-
-const char *
-randombytes_implementation_name(void)
-{
- return implementation->implementation_name();
-}
-
-uint32_t
-randombytes_random(void)
-{
- return implementation->random();
-}
-
-void
-randombytes_stir(void)
-{
- if (implementation != NULL && implementation->stir != NULL) {
- implementation->stir();
- }
-}
-
-/*
- * randombytes_uniform() derives from OpenBSD's arc4random_uniform()
- * Copyright (c) 2008, Damien Miller <djm at openbsd.org>
- */
-uint32_t
-randombytes_uniform(const uint32_t upper_bound)
-{
- uint32_t min;
- uint32_t r;
-
- if (implementation != NULL && implementation->uniform != NULL) {
- return implementation->uniform(upper_bound);
- }
- if (upper_bound < 2) {
- return 0;
- }
- min = (uint32_t) (-upper_bound % upper_bound);
- do {
- r = randombytes_random();
- } while (r < min);
-
- return r % upper_bound;
-}
-
-void
-randombytes_buf(void * const buf, const size_t size)
-{
- if (size > (size_t) 0U) {
- implementation->buf(buf, size);
- }
-}
-
-int
-randombytes_close(void)
-{
- if (implementation != NULL && implementation->close != NULL) {
- return implementation->close();
- }
- return 0;
-}
-
-void
-randombytes(unsigned char * const buf, const unsigned long long buf_len)
-{
- assert(buf_len <= SIZE_MAX);
- randombytes_buf(buf, (size_t) buf_len);
-}
=====================================
libsodium/randombytes/sysrandom/randombytes_sysrandom.c deleted
=====================================
--- a/libsodium/randombytes/sysrandom/randombytes_sysrandom.c
+++ /dev/null
@@ -1,302 +0,0 @@
-
-#include <sys/types.h>
-#ifndef _WIN32
-# include <sys/stat.h>
-# include <sys/time.h>
-#endif
-#ifdef __linux__
-# include <sys/syscall.h>
-#endif
-
-#include <assert.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <limits.h>
-#include <stdint.h>
-#include <stdlib.h>
-#include <string.h>
-#ifndef _WIN32
-# include <unistd.h>
-#endif
-
-#include "randombytes.h"
-#include "randombytes_sysrandom.h"
-#include "utils.h"
-
-#ifdef _WIN32
-# include <windows.h>
-# define RtlGenRandom SystemFunction036
-# if defined(__cplusplus)
-extern "C"
-# endif
-BOOLEAN NTAPI RtlGenRandom(PVOID RandomBuffer, ULONG RandomBufferLength);
-# pragma comment(lib, "advapi32.lib")
-#endif
-
-#ifdef __OpenBSD__
-
-uint32_t
-randombytes_sysrandom(void)
-{
- return arc4random();
-}
-
-void
-randombytes_sysrandom_stir(void)
-{
-}
-
-void
-randombytes_sysrandom_buf(void * const buf, const size_t size)
-{
- return arc4random_buf(buf, size);
-}
-
-int
-randombytes_sysrandom_close(void)
-{
- return 0;
-}
-
-#else /* __OpenBSD__ */
-
-typedef struct SysRandom_ {
- int random_data_source_fd;
- int initialized;
- int getrandom_available;
-} SysRandom;
-
-static SysRandom stream = {
- SODIUM_C99(.random_data_source_fd =) -1,
- SODIUM_C99(.initialized =) 0,
- SODIUM_C99(.getrandom_available =) 0
-};
-
-#ifndef _WIN32
-static ssize_t
-safe_read(const int fd, void * const buf_, size_t size)
-{
- unsigned char *buf = (unsigned char *) buf_;
- ssize_t readnb;
-
- assert(size > (size_t) 0U);
- do {
- while ((readnb = read(fd, buf, size)) < (ssize_t) 0 &&
- (errno == EINTR || errno == EAGAIN)); /* LCOV_EXCL_LINE */
- if (readnb < (ssize_t) 0) {
- return readnb; /* LCOV_EXCL_LINE */
- }
- if (readnb == (ssize_t) 0) {
- break; /* LCOV_EXCL_LINE */
- }
- size -= (size_t) readnb;
- buf += readnb;
- } while (size > (ssize_t) 0);
-
- return (ssize_t) (buf - (unsigned char *) buf_);
-}
-#endif
-
-#ifndef _WIN32
-static int
-randombytes_sysrandom_random_dev_open(void)
-{
-/* LCOV_EXCL_START */
- struct stat st;
- static const char *devices[] = {
- "/dev/urandom",
- "/dev/random", NULL
- };
- const char ** device = devices;
- int fd;
-
- do {
- fd = open(*device, O_RDONLY);
- if (fd != -1) {
- if (fstat(fd, &st) == 0 && S_ISCHR(st.st_mode)) {
-# if defined(F_SETFD) && defined(FD_CLOEXEC)
- (void) fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
-# endif
- return fd;
- }
- (void) close(fd);
- } else if (errno == EINTR) {
- continue;
- }
- device++;
- } while (*device != NULL);
-
- errno = EIO;
- return -1;
-/* LCOV_EXCL_STOP */
-}
-
-# ifdef SYS_getrandom
-static int
-_randombytes_linux_getrandom(void * const buf, const size_t size)
-{
- int readnb;
-
- assert(size <= 256U);
- do {
- readnb = syscall(SYS_getrandom, buf, (int) size, 0);
- } while (readnb < 0 && (errno == EINTR || errno == EAGAIN));
-
- return (readnb == (int) size) - 1;
-}
-
-static int
-randombytes_linux_getrandom(void * const buf_, size_t size)
-{
- unsigned char *buf = (unsigned char *) buf_;
- size_t chunk_size = 256U;
-
- do {
- if (size < chunk_size) {
- chunk_size = size;
- assert(chunk_size > (size_t) 0U);
- }
- if (_randombytes_linux_getrandom(buf, chunk_size) != 0) {
- return -1;
- }
- size -= chunk_size;
- buf += chunk_size;
- } while (size > (size_t) 0U);
-
- return 0;
-}
-# endif
-
-static void
-randombytes_sysrandom_init(void)
-{
- const int errno_save = errno;
-
-# ifdef SYS_getrandom
- {
- unsigned char fodder[16];
-
- if (randombytes_linux_getrandom(fodder, sizeof fodder) == 0) {
- stream.getrandom_available = 1;
- errno = errno_save;
- return;
- }
- stream.getrandom_available = 0;
- }
-# endif
-
- if ((stream.random_data_source_fd =
- randombytes_sysrandom_random_dev_open()) == -1) {
- abort(); /* LCOV_EXCL_LINE */
- }
- errno = errno_save;
-}
-
-#else /* _WIN32 */
-
-static void
-randombytes_sysrandom_init(void)
-{
-}
-#endif
-
-void
-randombytes_sysrandom_stir(void)
-{
- if (stream.initialized == 0) {
- randombytes_sysrandom_init();
- stream.initialized = 1;
- }
-}
-
-static void
-randombytes_sysrandom_stir_if_needed(void)
-{
- if (stream.initialized == 0) {
- randombytes_sysrandom_stir();
- }
-}
-
-int
-randombytes_sysrandom_close(void)
-{
- int ret = -1;
-
-#ifndef _WIN32
- if (stream.random_data_source_fd != -1 &&
- close(stream.random_data_source_fd) == 0) {
- stream.random_data_source_fd = -1;
- stream.initialized = 0;
- ret = 0;
- }
-# ifdef SYS_getrandom
- if (stream.getrandom_available != 0) {
- ret = 0;
- }
-# endif
-#else /* _WIN32 */
- if (stream.initialized != 0) {
- stream.initialized = 0;
- ret = 0;
- }
-#endif
- return ret;
-}
-
-uint32_t
-randombytes_sysrandom(void)
-{
- uint32_t r;
-
- randombytes_sysrandom_buf(&r, sizeof r);
-
- return r;
-}
-
-void
-randombytes_sysrandom_buf(void * const buf, const size_t size)
-{
- randombytes_sysrandom_stir_if_needed();
-#ifdef ULONG_LONG_MAX
- /* coverity[result_independent_of_operands] */
- assert(size <= ULONG_LONG_MAX);
-#endif
-#ifndef _WIN32
-# ifdef SYS_getrandom
- if (stream.getrandom_available != 0) {
- if (randombytes_linux_getrandom(buf, size) != 0) {
- abort();
- }
- return;
- }
-# endif
- if (stream.random_data_source_fd == -1 ||
- safe_read(stream.random_data_source_fd, buf, size) != (ssize_t) size) {
- abort(); /* LCOV_EXCL_LINE */
- }
-#else
- if (size > (size_t) 0xffffffff) {
- abort(); /* LCOV_EXCL_LINE */
- }
- if (! RtlGenRandom((PVOID) buf, (ULONG) size)) {
- abort(); /* LCOV_EXCL_LINE */
- }
-#endif
-}
-
-#endif /* __OpenBSD__ */
-
-const char *
-randombytes_sysrandom_implementation_name(void)
-{
- return "sysrandom";
-}
-
-struct randombytes_implementation randombytes_sysrandom_implementation = {
- SODIUM_C99(.implementation_name =) randombytes_sysrandom_implementation_name,
- SODIUM_C99(.random =) randombytes_sysrandom,
- SODIUM_C99(.stir =) randombytes_sysrandom_stir,
- SODIUM_C99(.uniform =) NULL,
- SODIUM_C99(.buf =) randombytes_sysrandom_buf,
- SODIUM_C99(.close =) randombytes_sysrandom_close
-};
=====================================
libsodium/sodium/core.c deleted
=====================================
--- a/libsodium/sodium/core.c
+++ /dev/null
@@ -1,18 +0,0 @@
-
-#include "core.h"
-#include "randombytes.h"
-#include "utils.h"
-
-static int initialized;
-
-int
-sodium_init(void)
-{
- if (initialized != 0) {
- return 1;
- }
- randombytes_stir();
-
- initialized = 1;
- return 0;
-}
=====================================
libsodium/wscript deleted
=====================================
--- a/libsodium/wscript
+++ /dev/null
@@ -1,18 +0,0 @@
-def build(ctx):
- srcnode = ctx.srcnode.abspath()
-
- libsodium_source = [
- "sodium/core.c",
- "randombytes/randombytes.c",
- "randombytes/sysrandom/randombytes_sysrandom.c"
- ]
-
- ctx(
- target = "sodium",
- features = "c cstlib",
- source = libsodium_source,
- includes = [
- "%s/libsodium/include/sodium" % srcnode
- ],
-
- )
=====================================
ntpd/wscript
=====================================
--- a/ntpd/wscript
+++ b/ntpd/wscript
@@ -132,7 +132,7 @@ def build(ctx):
target = "ntpd",
features = "c rtems_trace cprogram bld_include src_include libisc_include libisc_pthread_include",
source = ntpd_source,
- use = "libntpd_obj isc ntp sodium M parse RT CAP SECCOMP PTHREAD CRYPTO DNS_SD DNS_SD_INCLUDES %s SOCKET NSL SCF" % use_refclock,
+ use = "libntpd_obj isc ntp sodium M parse RT SODIUM CAP SECCOMP PTHREAD CRYPTO DNS_SD DNS_SD_INCLUDES %s SOCKET NSL SCF" % use_refclock,
includes = [
"%s/host/ntpd/" % ctx.bldnode.parent.abspath(),
"%s/ntpd/" % srcnode,
=====================================
wafhelpers/configure.py
=====================================
--- a/wafhelpers/configure.py
+++ b/wafhelpers/configure.py
@@ -552,6 +552,9 @@ def cmd_configure(ctx, config):
from wafhelpers.check_cap import check_cap
check_cap(ctx)
+ from wafhelpers.check_sodium import check_sodium
+ check_sodium(ctx)
+
from wafhelpers.check_seccomp import check_seccomp
check_seccomp(ctx)
=====================================
wscript
=====================================
--- a/wscript
+++ b/wscript
@@ -181,7 +181,6 @@ def build(ctx):
if ctx.env.REFCLOCK_GENERIC: # Only required by the generic refclock
ctx.recurse("libparse")
ctx.recurse("libntp")
- ctx.recurse("libsodium")
ctx.recurse("ntpd")
ctx.recurse("ntpfrob")
ctx.recurse("ntptime")
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/commit/5d4b3c613262f4794a0449d98791ea7adae27a9b
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ntpsec.org/pipermail/vc/attachments/20170118/d772aab7/attachment.html>
More information about the vc
mailing list